Status
Not open for further replies.
Tutorial  Updated

Admin Access on any Windows 7 Machine

This one's an oldie, and if you don't have access to the BIOS for some reason then this is perfect. It takes some time, but yeah.

So the first thing you want to do is get the recovery options menu (see below)
There's multiple ways of doing this, such as force shutting down your PC, pressing CTRL + ALT + DELETE until you get it, or holding down the F8 key during boot.

2g6BK2e3DiXe0Ff_h3lgJTT-SBgeh0_vfKU9mDDi6J0nOPtOF8grXFRpyubdwCSgupxyBo_efm_PG_HzhvQud68BsJ2NQN4HxlAbLjiZA29-TUAx1AYkg94wT1L4EWLruC9hDhd18SNMtmcMHHck5w_NBE_olXZUssZWqkJIbWN7gOZrk0gU3feZjiHjeTkJNDn0X4ArsWpsJEEjlpvZjsdzQDb2SY1YNsQR3sJGEpCdUQAjjNSLgxNs9nwQ6jShD_d__MZXt6rTfcV8QA5rmmFMxOaJDglQpss0ZeAWtn50DgoSyE1QJ8A9JkGfIWMk7_Xe3-DCXJyI1WL6-yyK2ceayjnK5cWpe1rP-E-eRQC41NnOI0ZWf10neOM3UrgJhjDFv_627hDgSC1tsDfuvYdcoWO47EyGH_ZcOsEBEED4JVuE3iYwceeuLLhKUq82yTJRnvwer3KuZlk28ZAJ8FjSSqr2s3kpYeDPwprDxuMdKdcGGsF-fm4XQc2N3PjoTZUnFI99DCqiXOylcnqiPmvB3frpQBucQJZ4lJzYMCORYqbnPfI-y7vD5Jihlwl0Td0hDrSQcQ-CazP-68gHgbUu7HQCo1S9ztAc9h3_0EQ71ek2xdDO=w640-h315-no


However you manage to get it, you're gonna want to select "Launch Startup Repair" as shown above.

Wait for it to "search for problems". This'll probably take awhile, so just give it a few minutes.If a popup that says "Do you want to restore your computer using System Restore" comes up, press CANCEL.

Wait for the "Startup Repair cannot repair this computer automatically" popup to show. This is where the fun begins!

Click "view problem details" and scroll to the bottom, where there'll be a link to a text file (should look like "X:\windows\blahblahblah"). Click on it and it'll open up notepad with some useless jabber. You can ignore all of this, it's not important.

Now, go to "File > Open". Now go to the "Computer" tab and navigate to "C:\Windows\" and make sure that the file type is changed from ".txt" to "all files". Next, scroll down and locate "cmd.exe". This is the command prompt, and we need this to give ourselves admin access. Next, make a copy of it (right click > copy, CTRL + C, whatever.) and then right click and paste it. This will make "cmd.exe - Copy".

Now, you're gonna want to find "sethc.exe". This is the program that executes the "Sticky Keys" popup (that annoying program that comes up when you press shift too many times). We're going to replace this with our copy of cmd.exe, so instead of the sticky keys popup, we'll get the Command Prompt. Neat, right? So all you need to do is rename "sethc.exe" to... anything that isn't "sethc.exe".

Once that's all done, go back to the copy of cmd.exe you made. Rename it from "cmd.exe - Copy" to "sethc.exe" (make sure it's "sethc.exe", not "sethc.exe.exe"!)

We're done here! Now close out of everything, click "don't send" and then "finish". Restart your machine into regular windows. If any error recovery prompt comes up, select "Start Windows Normally".

Once you're at the login screen, don't log in. You're going to click shift until the Command Prompt window comes up. Success! If it doesn't come up, you did something wrong. Repeat the steps until you get it.

Now, we enable the default "Administrator" account, giving us admin access. We can do this because at the login screen, we're actually using a user account called "SYSTEM" that has full privileges. This is what's used to log users in and some other stuff. (You can type "explorer.exe" into the command prompt and the start menu will show up. Neat!)

Now, let's set a password for the administrator account. Type "net user Administrator *", and enter your desired password.

Now, chances are if you try logging in with the Administrator account and its new password, it'll probably say "the account has been disabled", so we'll have to re-enable it. Bring up your cmd again, and continue.

To activate it, type "net user Administrator /Active:yes". The account will be activated! You can verify by typing "net user Administrator".

That's it! Now log in and do whatever you want to the computer. I take no responsibility for any damage you do to school/work/public property! Have fun!

TL;DR?
No. Read it.


**EDIT**
If anyone wants I'll make a video on it
 
Last edited by ,

GerbilSoft

Well-Known Member
Member
Joined
Mar 8, 2012
Messages
2,395
Trophies
2
Age
34
XP
4,249
Country
United States
here i thought everyone knew how to do this, btw a similar bug still exists in windows 10 however it doesnt work with a m$ft linked account
This isn't really a "bug" per se. If an attacker obtains physical access and can boot the system to an arbitrary storage device, all bets are off.

The only ways to protect against this:
  1. UEFI secure boot with a custom signature, not the standard MS signature. (Difficulty: High)
  2. Full disk encryption. (Difficulty: Medium)
UEFI secure boot won't protect against the attacker moving the HDD to another system.
FDE is still vulnerable to some types of attacks, e.g. a malicious bootloader that steals the encryption key. Workaround is to have the bootloader on a separate USB drive, but that adds complexity.
 

Jayro

MediCat USB Dev
Developer
Joined
Jul 23, 2012
Messages
12,972
Trophies
4
Location
WA State
Website
ko-fi.com
XP
16,996
Country
United States
Yes, it should work.



That might work. I used this method because it requires no extra setup or preparation.



Oh god, tell me about it. This company recycled a whole bunch of expensive laptops and I grabbed one because I could use it for work (6GB of RAM and an i5, who wouldn't?) But they had locked down the BIOS.
Luckily, I came across http://bios-pw.org, a site where they have all of the master BIOS keys for laptops stored. All you have to do is enter the serial number and you're in!



You can always trust the Chinese for quality bootlegs ;)



That's quite interesting, I've never seen that before.
My MediCat boot disk has Windows 7, 8.1, and 10 repair discs on it. Just grab the Naked build of the MediCat DVD. Link in my sig.
 
D

Deleted User

Guest
OP
My MediCat boot disk has Windows 7, 8.1, and 10 repair discs on it. Just grab the Naked build of the MediCat DVD. Link in my sig.
MediCat - damn, that's actually really cool! I might have to use that :P
 

Dr.Hacknik

Ashley | Developer | Trans
Member
Joined
Mar 26, 2014
Messages
1,773
Trophies
1
Age
24
Location
inside your fridge
Website
dochacknik.keybase.pub
XP
2,219
Country
United States
You can just run a command prompt from the utilities window. Then do everything from there. Your method is just less convient. :/

You can also run a basic file explorer; all by running the command prompt, notepad, then selecting to show all files, and just right click an executable and run it as administrator. You can do that with something like a Windows installer; like Windows 10. Then you can use the installer to wipe the drive and install Windows.

EDIT:


Also in most cases you can just press SHIFT + F10. Which will open a command prompt. No matter where you are in the Windows Installer Environment.
 
Last edited by Dr.Hacknik,

gudenau

Largely ignored
Member
Joined
Jul 7, 2010
Messages
3,882
Trophies
2
Location
/dev/random
Website
www.gudenau.net
XP
5,378
Country
United States
I've had to do this on Windows 10 with a Linux live CD before.

--------------------- MERGED ---------------------------

This isn't really a "bug" per se. If an attacker obtains physical access and can boot the system to an arbitrary storage device, all bets are off.

The only ways to protect against this:
  1. UEFI secure boot with a custom signature, not the standard MS signature. (Difficulty: High)
  2. Full disk encryption. (Difficulty: Medium)
UEFI secure boot won't protect against the attacker moving the HDD to another system.
FDE is still vulnerable to some types of attacks, e.g. a malicious bootloader that steals the encryption key. Workaround is to have the bootloader on a separate USB drive, but that adds complexity.

How does one setup a custom signature?
 

smf

Well-Known Member
Member
Joined
Feb 23, 2009
Messages
6,642
Trophies
2
XP
5,860
Country
United Kingdom
FDE is still vulnerable to some types of attacks, e.g. a malicious bootloader that steals the encryption key.

If you have secureboot, TPM 2 and an SSD with hardware bitlocker support then it's pretty secure. The TPM shouldn't give out the key if any of the boot files are modified and it's not stored in ram for anything to steal it. You probably want to store a copy of your bitlocker key somewhere though, in case you need it to recover the data.

If you're using Windows 10 Home then it automatically escrows the key with microsoft, which is probably not what you want. So Windows 10 Pro is the one to get, if anyone asks why then say it's for developing Android apps (because you need HyperV to run the Android emulator in Visual Studio and that only comes with Windows 10 Pro).
 
  • Like
Reactions: Deleted User
Status
Not open for further replies.

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    Xdqwerty @ Xdqwerty: @SylverReZ, @AncientBoi my condolences to both of you +2